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Full Text Articles 
6 December O01 
Hacker views MCI network data 
Computer sleuth gained access to private corporate lines 


By Bob Sullivan 
MSNBC 


Dec. 5 — A 20-year-old computer securi: rcher managed to crack several MCI Worldcom. 
networks last week and view dozens.oftt ipany’s private networks. The perpetrator, Adrian 
Lamo, told MSNBC.com he obtained thousands of employee records and, while posing as 
various MCI Worldcom workers, found he could have compromised networks belonging to 
dozens of big-name clients, such as Bank of America, Citicorp, and Pfizer. Lamo subsequently 
contacted MCI Worldcom and the security flaw has been fixed. 


AN MCI SPOKESPERSON admitted the company had a security vulnerability, but said no 
customer networks were compromised. 

“We did discover on Friday that unauthorized access could be made to an administrative 
internal data network used by employees to access intemal Web sites and information. There was 
no customer network impact,” she said. 

Lamo told MSNBC.com he began breaking into MCI Worldcom’s network with a simple 
hack of an MCI Worldcom Web server — hardly a newsworthy event. But from there, the 
researcher was able to gain access to itical internal networks. As a result, he was 
able to obtain lists of thousands of etapl their social security numbers. Armed with 
those, and a date of birth obtained from Web site Anybirthday.com, Lamo was able to reset 
employee passwords. 

From there, breaking into other critical networks was a breeze, since he could now 
impersonate company employees. 

“I managed to reset someone’s password at the director level,” Lamo said. “I was able to use 
his online ID to create new employees, and could have requested the hiring of contractors ... 1 
could have changed direct deposit information.” 

Equally alarming, Lamo could have accessed private circuit networks operated by MCI for 
Fortune 500 companies. These networks are used only to connect corporate offices and are 
generally considered to be very secure because they are not connected to the Internet. 

“I could have cut off segments of the company from each other,” Lamo said, “If! zeroed out 
the configuration settings for Cisco routers that would have required site visits to restore 
communications between offices.” 


rks were vulnerable, including firms like 
Block, and General Electric. He provided 


Lamo said over 500 companies’ piivate i 
Chase Mellon, Daimler Chrysler, FOX TV, H 
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documentation to MSNBC.com to support the claim. 

Lamo first contacted MCI Worldcom Friday through an intermediary, Kevin Poulsen, a 
writer for computer security Web site SecurityFocus.com. Lamo said MCI Worldcom responded 
quickly to close the hole. 

“They pulled people in off other projects and worked through the weekend with me,” he said. 

The root of the problem at MCI Worldcom is common in many businesses, Lamo said — 
most systems don’t provide enough internal security. Once he was able to break into a common 
Web server, that machine had a “trust” relationship with other machines on the network, allowing 
Lamo to “escalate” his privileges and his attack, _ 

“It’s a problem to have a machine facing thé outside world, but also trusted by an internal 
network,” he said. 

Similarly, internal employees often -have more access to critical networks than necessary. 
Even if such employees would never do anything to compromise the company themselves, their 
access rights are another point of attack for hackers. 

“A lot of time there is an inappropriate degree of trust given to users who appear to be 
internal,” Lamo said. 


NOT THE FIRST TIME 

The researcher is no stranger to high-profile security warnings. Earlier this year, he found a 
way to alter news stories on Yahoo.com’s Web site. Last year, he found a way to break into AOL 
Instant Messenger accounts. In each case, he warned the company and, in an unusual bit of 
hacker forthrightness, used his real name. Hackers: generally use pseudonyms out of fear of 
retribution or prosecution. : 


Computer Security Advisory Site Suffers Attack 


By Brian McWilliams, 
Newsbytes 
5 Dec 2001 


The Web site of the Computer Emergency Response Team (CERT) is undergoing a distributed 
denial of service attack, officials at the federally funded computer security clearinghouse 
confirmed today. As a result of the attack, the CERT.org site was intermittently unreachable 
today for many Internet users. : 


CERT, located at Carnegie Mellon University, provides advisories and other information about 
security vulnerabilities as well as serving as a coordination center for reports of security 
incidents. 7 


ACERT representative declined to provide details about the nature of the attack. A new Internet 
worm known as Goner, which contains a denial of service component, was not responsible for 
the attack on CERT.org, the official added. 
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On 6/28/2007, Special Agents (SA) 
collected a known DNA sample from Adrian A. Lamo, date of 
birth 02/20/1981, Social Security Account Number 042-74-6804, at 
the U.S. Probation Office in Sacramento, California. Lamo arrived 
at 3:22 p.m. 


Lamo provided his California driver's license (D1225973) 
as a form of identification. Lamo's left index finger fingerprint 
was collected and placed on both the Missouri State Highway Patrol 
convicted offender DNA sample collection c the request 
for national DNA database entry card by eS remem | Lamo's right 
index finger was also printed and placed on the national DNA 
database entry card. 


saL____] collected a saliva/buccal sample from Lamo 
with the green Toothette sponge applicator as described by the 
Missouri State Highway Patrol protocol. The saliva/buccal sample 
was transferred to the Missouri State Highway Patrol convicted 
offender DNA sample collection card. This process was repeated 
with a new applicator. 


saL___]collected saliva/buccal sample from Lamo with 
two sterile cotton swabs. This process was repeated twice. The 
swabs were allowed to air dry in a swab drying rack prior to 


packaging. 
Lamo departed the office at 3:29 p.m. 
6/28/2007 Sacramento, California 
6/29/2007 
SA 
SA 
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